Dynamic security protection method and device based on zero trust and virtual desktop, and storage medium

Abstract

The invention provides a dynamic security protection method and device based on zero trust and a virtual desktop, electronic equipment and a storage medium, and the method comprises the steps: collecting software and hardware security compliance data through a terminal agent module, and triggering zero trust multi-factor authentication on the premise of terminal compliance; after the authentication is passed, matching a desktop instance allocation strategy from a strategy knowledge base according to a user role, and creating a containerized virtual desktop instance of a corresponding authority; user operation behaviors and terminal security states are monitored in real time, and when high-risk behaviors such as data export or unauthorized equipment connection are detected, the linkage decision engine dynamically triggers security policies such as blocking operation, instance freezing or audit log generation in combination with the current compliance state and authority information. According to the method, closed-loop security management from admission control to runtime protection is realized, the active defense capability for internal threats and external attacks is improved, the problem of security response lag of a traditional static permission model is solved, and the method is suitable for remote office scenes with high security requirements.

Description

Technical Field

[0001] This invention relates to the technical field of network security and access control, and specifically to a dynamic security protection method, storage medium, and device based on zero trust and virtual desktops. Background Technology

[0002] In existing technologies, enterprise office environments commonly employ independent solutions such as endpoint security management, zero-trust architecture, or virtual desktop infrastructure (VDI) for network security protection. However, these solutions exhibit significant fragmentation: endpoint management systems can only detect device compliance and cannot dynamically link with access control policies; zero-trust authentication relies heavily on static identity verification, lacking continuous assessment of the endpoint's real-time security status; while VDI enables data to remain embedded, it typically assumes the access endpoint is trusted, ignoring the risks of front-end devices. Furthermore, scattered system logs make cross-domain behavior correlation analysis difficult, resulting in the inability to promptly detect internal threats and lateral movement attacks. In remote work and BYOD scenarios, the endpoint environment is uncontrollable, and traditional solutions cannot ensure consistency between the access subject, device status, and operational behavior, leading to security risks such as abuse of permissions after authentication, session hijacking caused by endpoint compromise, and unauthorized export of sensitive data. Existing technologies lack a mechanism to deeply integrate endpoint compliance status, dynamic identity authentication, and virtual desktop access control, failing to achieve closed-loop management across the entire "endpoint-identity-resource" chain, and thus failing to meet the needs of high-security industries for continuous verification, least privilege, and automatic response. Summary of the Invention

[0003] Based on this, in order to address the problem that static permission control in traditional virtual desktop architecture is unable to cope with the risk of linkage between internal threats and external attacks, and the security protection is lagging behind due to the lack of a continuous trust assessment mechanism, a dynamic security protection method, storage medium and device based on zero trust and virtual desktop are proposed.

[0004] This invention protects a dynamic security protection method based on zero trust and virtual desktops, comprising the following steps: collecting and reporting the hardware and software security compliance data of the terminal through an agent module deployed on the user terminal; obtaining the user's business access request, and using the hardware and software security compliance data to determine that the terminal is in a compliant state, allowing user authentication, with authentication being zero trust multi-factor authentication; after successful user authentication, allocating a corresponding virtual desktop instance according to the user's identity and permissions, and establishing and maintaining a unique association mapping relationship between the terminal, user identity, and virtual desktop instance; during the user's use of the virtual desktop instance, monitoring the user's operation behavior and the terminal's security status in real time, and executing dynamically triggered security policies based on the operation behavior and / or security status.

[0005] Furthermore, through the agent module deployed on the user terminal, the software and hardware security compliance data of the terminal is collected and reported, including: automatically performing compliance checks when the terminal starts up. The compliance checks include detecting whether the operating system patch version has reached a preset version threshold, detecting whether the antivirus software virus database update time is within a preset time range, and detecting whether an unauthorized external storage device is connected; and generating software and hardware security compliance data of the terminal based on the compliance check results.

[0006] Furthermore, hardware compliance data includes CPU model, memory capacity, and external device type; software compliance data includes patch version, antivirus software status, and process list.

[0007] Furthermore, when using hardware and software security compliance data to determine whether a business access request terminal is in a compliant state, user authentication is permitted, including: capturing access request events sent by the portal system through an event-driven architecture, extracting terminal device identifiers, user identity identifiers, and timestamp metadata from the request header, and generating standardized authentication context objects; initiating real-time queries to the data fusion engine by calling the compliance status query interface, with the query using a bidirectional streaming communication protocol to transmit serialized data; performing multi-source data association queries in the data fusion engine, including retrieving terminal compliance assessment results from a distributed cache and using a Bloom filter to verify the mapping relationship between terminal identity and compliance reports; using a state machine verification model to perform terminal compliance verification, with the model calculating a comprehensive compliance score based on a preset set of compliance rules; and dynamically assembling a two-factor authentication combination including password and facial recognition when the comprehensive compliance score reaches a threshold.

[0008] Furthermore, the process of allocating corresponding virtual desktop instances based on user identity and permissions, and establishing and maintaining a unique association mapping relationship between the terminal, user identity, and virtual desktop instance includes: after user authentication, obtaining user role attributes, matching the corresponding desktop instance allocation policy template from the policy knowledge base based on the user role attributes, where ordinary employee roles correspond to basic office desktop instance configuration parameters, and administrator roles correspond to desktop instance configuration parameters including operation and maintenance tool images and privileged instruction sets; submitting the matched desktop instance allocation policy template to the policy description language parser for syntax analysis and semantic verification to generate a structured policy object; calling the resource scheduling interface of the virtual desktop management platform to pass the structured policy object to create a containerized virtual desktop instance with the corresponding permission level; and simultaneously initiating the three-element mapping binding process, writing the terminal device fingerprint hash value, user identity token, and the created virtual desktop instance ID as association keys into the distributed key-value database, and setting access control policies.

[0009] Furthermore, during the user's use of the virtual desktop instance, the system monitors the user's operational behavior and the terminal's security status in real time, and executes dynamically triggered security policies based on the operational behavior and / or security status. This includes: when a user is detected performing a data export operation or connecting an external storage device within the virtual desktop, the system collects operational behavior data through an agent module deployed within the virtual desktop and uploads the data to the linkage decision engine; the linkage decision engine obtains the terminal's current compliance status and the user's identity and permission information, whereby the terminal's compliance status is obtained from a distributed key-value database, and the user's identity and permission information is retrieved from a policy knowledge base; if the terminal's current compliance status is non-compliant, or the operational behavior exceeds the user's identity and permission scope, a data protection policy is triggered. This data protection policy includes blocking the current file export operation, freezing the virtual desktop instance, generating an audit log containing operational behavior data, the terminal device's fingerprint hash value, the user's identity token, and a timestamp, and pushing the audit log to the administrator's backend system.

[0010] This invention protects a dynamic security protection device based on zero trust and virtual desktops, comprising: a proxy data acquisition module, used to collect and report the terminal's software and hardware security compliance data through a proxy module deployed on the user terminal; an access request processing module, used to obtain the user's business access request, and when the software and hardware security compliance data determines that the terminal is in a compliant state, allow the user to be authenticated, with the authentication being zero trust multi-factor authentication; a virtual desktop allocation module, used to allocate corresponding virtual desktop instances according to the user's identity and permissions after the user's authentication is successful, and establish and maintain a unique association mapping relationship between the terminal, the user's identity, and the virtual desktop instance; and a dynamic policy execution module, used to monitor the user's operation behavior and the terminal's security status in real time during the user's use of the virtual desktop instance, and execute dynamically triggered security policies based on the operation behavior and / or security status.

[0011] This invention protects a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of the dynamic security protection method based on zero trust and virtual desktop as described in any one of claims 1 to 7.

[0012] This invention protects a dynamic security protection method based on zero trust and virtual desktops. Its core lies in collecting hardware and software security compliance data through a terminal agent module, using this as a prerequisite for access control. Zero-trust multi-factor authentication is only allowed after ensuring the terminal is in a compliant state, effectively preventing potential risks from insecure devices accessing the system. After user authentication, virtual desktop instances are dynamically allocated based on their permissions, establishing a unique association mapping between the terminal, user identity, and virtual desktop. This achieves minimal authorization and logical isolation of resource access, improving the protection level of sensitive data. Furthermore, during user operation, operational behavior and terminal security status are continuously monitored, and corresponding security policies, such as session blocking, permission downgrading, or re-authentication, are dynamically triggered based on real-time analysis results. This forms a closed-loop security management mechanism from access control to runtime protection, significantly enhancing the system's proactive defense capabilities and response efficiency to internal threats. Overall, it solves the problem that traditional static boundary protection models are unable to cope with complex terminal environments and lateral movement attacks, making it suitable for remote office and business access control in high-security scenarios. Attached Figure Description

[0013] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings: Figure 1 This application provides a schematic diagram of a dynamic security protection method based on zero trust and virtual desktops.

[0014] Figure 2 This application presents a schematic diagram of the structure of a dynamic security protection device based on zero trust and virtual desktops. Detailed Implementation

[0015] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely represents selected embodiments of this application. Based on the embodiments of this application, every other embodiment obtained by those skilled in the art without inventive effort falls within the scope of protection of this application.

[0016] Research has revealed that traditional network security architectures are typically based on perimeter defense models, assuming the internal network is trustworthy. This allows attackers to move laterally once they breach the outer defenses, leading to sensitive data leaks or system damage. With the widespread adoption of remote work, mobile device access, and cloud services, the terminal environment is becoming increasingly complex, making traditional static access control strategies inadequate for handling dynamically changing security threats. Furthermore, while existing virtual desktop technologies can achieve a certain degree of data isolation, they lack continuous verification mechanisms for the security status of terminal hardware and software, and the authentication process often relies on a single factor, failing to meet the zero-trust principle requirements of high-security scenarios. Simultaneously, the lack of real-time monitoring and dynamic response capabilities for user behavior and terminal status during user sessions makes it difficult to promptly detect and block abnormal behavior, posing significant security vulnerabilities.

[0017] Please see Figure 1 This application provides a dynamic security protection method based on zero trust and virtual desktops. This method collects compliant data through a terminal agent, combines multi-factor authentication, authorized virtual desktop allocation, and runtime dynamic monitoring to construct an end-to-end secure access loop. Specifically, it includes the following steps: The agent module deployed on the user terminal collects and reports the terminal's hardware and software security compliance data. When a user's business access request is obtained, and the software and hardware security compliance data is used to determine that the terminal requesting the business access request is in a compliant state, the user's identity verification is allowed. The identity verification is zero-trust multi-factor authentication. After user authentication is successful, a corresponding virtual desktop instance is allocated according to the user's identity and permissions, and a unique association mapping relationship is established and maintained among the terminal, user identity and the virtual desktop instance. During the user's use of the virtual desktop instance, the system monitors the user's operation behavior and the security status of the terminal in real time, and executes dynamic security policies based on the operation behavior and / or security status.

[0018] This application provides a dynamic security protection method based on zero trust and virtual desktops, which can effectively improve the overall security of enterprise information systems. By deploying an agent module on the terminal side to achieve comprehensive collection and reporting of software and hardware security compliance, it ensures that devices accessing the system meet preset security baselines. During the access request phase, a prerequisite judgment based on compliance status is introduced, initiating the identity authentication process only when the terminal is in a trusted state, avoiding the waste of resources on ineffective authentication of insecure terminals. A zero-trust multi-factor authentication mechanism is adopted to enhance the reliability of identity recognition and prevent credential theft or impersonation. After successful authentication, virtual desktop instances are accurately allocated according to user permissions, and a unique mapping relationship is established between the terminal, user identity, and virtual desktop, achieving minimum permission control and traceability of resource access. During the session, user operation behavior and terminal security status are continuously monitored, and abnormal behavior detection is achieved by combining a rule engine or AI model, dynamically triggering security policies such as alarms, session interruption, and permission downgrading, significantly enhancing the real-time response capability to internal threats and external attacks. This constructs a full-cycle, fine-grained, and adaptive security protection system from access control to runtime protection.

[0019] S101: Collect and report the hardware and software security compliance data of the terminal through the agent module deployed on the user terminal; In step S101, when a user terminal boots up or connects to the enterprise network, a lightweight agent module deployed in its operating system is automatically activated. This agent module acts as a communication hub between the terminal and the backend security management platform. It is responsible for actively collecting the hardware and software status information of the terminal device, encrypting and structuring the collected data, and then reporting it to the centralized management platform for subsequent identity access control decisions.

[0020] Preferably, the process of collecting and reporting hardware and software security compliance data of the terminal through an agent module deployed on the user terminal includes the following steps: S1011: Automatically perform compliance checks when the terminal starts up. The compliance checks include detecting whether the operating system patch version has reached a preset version threshold, detecting whether the antivirus software virus database update time is within a preset time range, and detecting whether an unauthorized external storage device is connected. Specifically, after the terminal completes system boot and loads the network protocol stack, the agent module immediately triggers a full compliance self-check process. This process performs several key checks based on a pre-delivered security policy template: First, it reads the current operating system's patch installation record, compares the locally installed patch version number with the minimum allowed version threshold defined in the policy (e.g., Windows patches must be no lower than version 2024.05), and determines whether there are any known vulnerability risks; second, it queries the status of the antivirus software service running on the terminal and its virus database last update time, verifying that this time is within the last 24 hours to ensure that the antivirus capability is in an effective protection state; third, it scans peripheral connection channels such as USB ports, Bluetooth, and Thunderbolt, identifies currently connected external storage devices (such as USB flash drives and external hard drives), and matches the device fingerprint hash value with the authorized device whitelist to determine whether there is any unauthorized external storage device access.

[0021] The hardware compliance data includes CPU model, memory capacity, and external device type; the software compliance data includes patch version, antivirus software status, and process list.

[0022] Furthermore, during the aforementioned compliance checks, the agent module simultaneously collects underlying hardware configuration information and runtime software environment data. Hardware compliance data includes the specific model of the central processing unit (CPU) (e.g., Intel Core i7-12650H), total physical memory capacity (e.g., 16GB DDR4), and the types of all currently connected external devices (e.g., "USB Mass Storage Device" or "Bluetooth Keyboard"). This information is used to construct a terminal device fingerprint, supporting subsequent device identification and anomaly detection. Software compliance data includes the patch version set of each component of the operating system, the running status of the antivirus software (running / stopped / disabled), and a real-time process list (including process name, PID, and signature status). In particular, processes with high-risk privileges or suspicious behavior characteristics (e.g., powershell.exe called without parameters) are marked to provide a basis for risk scoring.

[0023] S1012: Generate hardware and software security compliance data for the terminal based on the compliance check results.

[0024] After completing all compliance item detections, the proxy module aggregates and integrates the detection results of each item to generate a structured "Terminal Software and Hardware Security Compliance Report". This report is encapsulated in a standardized format and includes the terminal's unique identifier (such as the hash value of the device's MAC address), timestamp, status flag (passed / failed) for each detection item, detailed parameter values, and a comprehensive compliance score. For example, when the operating system patches meet the standards, the antivirus software is running normally, and there is no unauthorized USB flash drive connected, the terminal is marked as "fully compliant"; if only some items do not meet the requirements, it enters the "conditional compliance" or "non-compliance" state. This compliance report is uploaded to the data fusion engine through a TLS encrypted channel for the联动决策引擎 (Linked Decision Engine) to call in real time during the authentication phase as an important pre-judgment basis for whether to allow users to enter the identity verification link. At the same time, this report is also persistently stored in the log audit system for security event backtracking and compliance auditing.

[0025] S102: Obtain the user's business access request. When it is determined that the terminal of the business access request is in a compliant state using the software and hardware security compliance data, allow user authentication, and the identity authentication is zero-trust multi-factor authentication; After completing the collection and reporting of the terminal software and hardware security compliance data in step S101, when a user attempts to access the enterprise internal business system, the system enters the access control decision-making process. Specifically, in step S102, the zero-trust authentication module listens for user access request events from the unified portal system in real time. This request is usually triggered when the user clicks the virtual desktop login entry or accesses protected application resources. The system first uses the terminal compliance status as a precondition for access. Only when it is confirmed that the requesting source terminal is in a secure and compliant state, does it start the subsequent identity authentication process, thus implementing a dual verification mechanism of "trusted device" and "trusted identity".

[0026] Preferably, when it is determined that the terminal of the business access request is in a compliant state using the software and hardware security compliance data, allowing user authentication includes the following steps: S1021: Capture the access request event sent by the portal system through an event-driven architecture, extract the terminal device identifier, user identity identifier, and timestamp metadata in the request header, and generate a standardized authentication context object; Furthermore, the zero-trust authentication module employs an event-driven architecture to integrate message middleware (such as Kafka or RabbitMQ), subscribing to and capturing access request events published by the front-end portal system in real time. Each request event carries HTTP request header information, including key metadata such as the terminal device fingerprint hash (e.g., unique device ID), user account identifier (e.g., AD domain account name), client IP address, and request timestamp. The authentication module has a built-in request parser that automatically parses these raw fields and encapsulates them into a structured authentication context object. This object follows a predefined data model format to support the context-aware decision-making process of the subsequent policy engine.

[0027] S1022: Initiate a real-time query to the data fusion engine by calling the compliance status query interface. The query uses a bidirectional streaming communication protocol to transmit serialized data. Perform multi-source data association query in the data fusion engine, including retrieving terminal compliance assessment results from the distributed cache and using a Bloom filter to verify the mapping relationship between terminal identity and compliance report. After generating the authentication context object, the linkage decision engine immediately invokes the compliance status query interface to initiate a real-time query to the data fusion engine for the current terminal's compliance status. This interface establishes a persistent connection channel based on the gRPC bidirectional streaming communication protocol, supporting low-latency, high-concurrency data interaction. The query command is serialized and transmitted in Protobuf format, including the terminal device's fingerprint hash value and the current session token, ensuring the authenticity of the request source and preventing replay attacks.

[0028] Upon receiving a query request, the data fusion engine initiates a multi-source data association query algorithm. First, the engine searches a distributed memory cache (such as a Redis cluster) for the most recently reported compliance assessment result from the terminal. If the cache is found and the result is not expired, it is returned directly. If the cache is invalid or missing, a real-time completion mechanism is triggered, proactively initiating a supplementary query to the terminal management module to obtain the latest compliance snapshot. Throughout the data association process, the system employs Bloom filter technology to quickly determine whether a particular terminal device has ever generated a compliance report, avoiding invalid database scans and improving query efficiency. Simultaneously, a hash matching mechanism verifies the binding relationship between the terminal's identity and its compliance report, preventing the use of forged device identities to bypass detection.

[0029] S1023: A state machine verification model is used for terminal compliance verification. The model calculates a comprehensive compliance score based on a preset set of compliance rules. When the comprehensive compliance score reaches a threshold, a two-factor authentication combination including password and facial recognition is dynamically assembled.

[0030] After obtaining the terminal compliance assessment results, the system uses a state machine verification model to make a final determination of the compliance status. This model presets three states: "Fully Compliant," "Conditionally Compliant," and "Violation," with the transition logic relying on a set of configurable compliance rules. Each rule corresponds to a security indicator (such as patch version compliance, antivirus software running, and no unauthorized peripherals) and is assigned a corresponding weight coefficient. For example, missing patches deduct 30 points, antivirus software being disabled deducts 40 points, and connecting an unauthorized USB drive deducts 50 points, with an initial maximum score of 100 points. The system calculates a weighted comprehensive compliance score based on the actual detection results.

[0031] When the overall compliance score exceeds a set threshold (e.g., 85 points), the terminal is deemed "compliant," and the system allows the process to proceed to the identity authentication stage. At this point, the authentication service dynamically assembles a zero-trust multi-factor authentication process based on the current context. For typical office scenarios, a "password + face" two-factor authentication combination is enabled by default: the password authentication process uses salted hashing technology to transmit credentials, preventing plaintext exposure; face recognition uses liveness detection algorithms (such as infrared imaging comparison and micro-expression analysis) to verify the authenticity of biometric features, preventing photo or video deception. Throughout the authentication process, the system continuously monitors changes in the terminal environment. If abnormal changes in the device fingerprint are detected (e.g., interruption of the proxy module's heartbeat), the authentication process is immediately terminated, and a security alert is recorded.

[0032] In summary, this step, through a rigorous pre-verification mechanism for terminal compliance, ensures that only devices that meet the security baseline can enter the identity authentication process, achieving an orderly progression from "trustworthy device" to "trustworthy identity," and laying a solid foundation for secure access to virtual desktops in the future.

[0033] S103: After the user authentication is successful, allocate a corresponding virtual desktop instance according to the user's identity and permissions, and establish and maintain a unique association mapping relationship between the terminal, the user identity and the virtual desktop instance; After completing zero-trust multi-factor authentication and confirming the user's legitimacy in step S102, the system enters the resource access authorization phase. At this point, the linkage decision engine initiates the on-demand allocation process of virtual desktop resources based on the verified user identity information and its permission attributes. This process not only dynamically matches the corresponding virtual desktop configuration parameters according to the user role, but also simultaneously builds and persists a unique binding relationship between the "terminal—user—desktop instance," ensuring that any access behavior during subsequent sessions can be traced back to the specific device and identity entity, preventing security risks such as cross-terminal impersonation and session hijacking.

[0034] Preferably, the process of allocating corresponding virtual desktop instances based on user identity and permissions, and establishing and maintaining a unique association mapping relationship between the terminal, user identity, and virtual desktop instances includes the following steps: S1031: After user authentication is successful, obtain the user role attributes, match the corresponding desktop instance allocation policy template from the policy knowledge base according to the user role attributes, where the ordinary employee role corresponds to the basic office desktop instance configuration parameters, and the administrator role corresponds to the desktop instance configuration parameters that include the operation and maintenance tool image and privileged instruction set. Specifically, after successful user authentication, the linkage decision engine extracts the user's identity tag information from the authentication context object, including attributes such as their organizational unit (OU), role tag, and security group in the enterprise directory service (such as Active Directory or LDAP). The system uses these attributes as query keys to initiate a retrieval request to a pre-configured policy knowledge base to find a matching desktop instance allocation policy template. This policy template is defined in YAML format and covers dimensions such as virtual machine resource configuration (e.g., number of vCPUs, memory size, disk capacity), network isolation level (e.g., VLAN segmentation or micro-segmentation policy), peripheral redirection permissions (e.g., USB, printer, clipboard control), and pre-installed software images.

[0035] For example, for the role of a regular employee, the system automatically matches the "Basic Office" desktop policy template, which is configured with a 2-core CPU, 8GB of memory, a secure sandbox environment with only the Office suite and browser installed, and disables all external device redirection functions. For the IT administrator role, the "Operations and Maintenance" template is matched, which includes a dedicated image with a 4-core CPU, 16GB of memory, pre-loaded PowerShell, SSH client, and database management tools, and allows limited command-line execution permissions. All policy templates are digitally signed to prevent unauthorized tampering.

[0036] S1032: Submit the matched desktop instance allocation policy template to the policy description language parser for syntax analysis and semantic verification to generate a structured policy object; call the resource scheduling interface of the virtual desktop management platform to pass the structured policy object to create a containerized virtual desktop instance with the corresponding permission level; at the same time, start the three-element mapping binding process, write the terminal device fingerprint hash value, user identity token and the created virtual desktop instance ID as the association key into the distributed key-value database, and set the access control policy.

[0037] After obtaining the target policy template, the system submits it to the policy description language parser for processing. This parser possesses syntax parsing and semantic validation capabilities, enabling it to identify the validity of fields, the integrity of dependencies, and the risk of unauthorized access in the YAML document. After parsing, the template is converted into an executable JSON-formatted structured policy object, containing information such as virtual desktop specification parameters, security policy rule sets, and data encryption requirements.

[0038] Subsequently, the linkage decision engine calls the resource scheduling module of the virtual desktop management platform via a RESTful API or gRPC interface, passing a structured policy object as an input parameter to trigger the creation process of containerized virtual desktop instances. This platform implements VDI resource orchestration based on the Kubernetes architecture, dynamically generating Pod instances using CRI (Container Runtime Interface) and injecting security policy proxies to ensure that new instances are under control from the moment they start.

[0039] Simultaneously, the system immediately initiates the triple mapping binding process. This process combines the three core identifiers of the current session—the terminal device fingerprint hash value (reported by the agent module), the user identity token (issued by the authentication service), and the unique ID of the newly created virtual desktop instance—into a triple mapping tuple, and writes it to a highly available distributed key-value database (such as etcd or Consul) via an encrypted channel. This record is configured with a TTL (Time-to-Live) expiration mechanism to ensure that the mapping relationship is automatically cleaned up after the session ends, preventing resource leaks.

[0040] In addition, while writing the mapping relationship, the system attaches fine-grained access control policies to the triple, such as restricting connections to the desktop instance to only the original terminal IP address, prohibiting concurrent logins by the same user identity on other devices, and enabling one-way clipboard copying. All operations are recorded to an audit queue via an asynchronous message bus (such as Kafka) for real-time consumption and behavior tracing by the SIEM system.

[0041] In summary, this step achieves differentiated virtual desktop resource allocation based on identity permissions, and establishes a strong binding relationship between terminals, users, and desktop instances through a ternary mapping mechanism, providing a reliable data foundation and contextual support for the accurate execution of subsequent dynamic security policies.

[0042] S104: During the user's use of the virtual desktop instance, monitor the user's operation behavior and the security status of the terminal in real time, and execute dynamic trigger security policies based on the operation behavior and / or security status.

[0043] After the allocation of the virtual desktop instance and the establishment of the ternary mapping relationship are completed in step S103, the user enters the remote office session phase. During this process, the system continuously monitors the operation behavior of the user in the virtual desktop and the security status of the original access terminal in real time in both directions. This mechanism breaks the traditional static authorization mode and instead adopts the zero-trust core concept of "continuous evaluation and dynamic response" to ensure that during the entire session life cycle, once it detects that the terminal environment deteriorates or the user behavior exceeds the authority, it immediately triggers corresponding security control measures to prevent the spread of data leakage or lateral penetration risks.

[0044] Preferably, during the process of the user using the virtual desktop instance, the operation behavior of the user and the security status of the terminal are monitored in real time, and dynamic security policies are executed based on the operation behavior and / or security status. The steps include: S1041: When it is detected that the user performs a data export operation or connects an external storage device in the virtual desktop, the proxy module deployed in the virtual desktop collects the operation behavior data and uploads the operation behavior data to the linkage decision engine; Specifically, a lightweight desktop proxy module is deployed inside each allocated virtual desktop instance. This module has the ability to capture behaviors and can listen for and identify sensitive operation events. When the user attempts to drag a file in the virtual desktop to the local disk, copy a large amount of text content through the clipboard, or mount an external storage device such as a USB flash drive or a mobile hard disk in the session, the desktop proxy module immediately captures the behavior data of such high-risk operations. The collected data includes but is not limited to: operation type (such as "file export"), target file path and size, peripheral device fingerprint hash value, source process name, and call stack information. These data are packaged as structured log entries and are pushed to the backend linkage decision engine in real time through an encrypted channel as the input basis for dynamic policy judgment.

[0045] S1042: The linkage decision engine obtains the current compliance status of the terminal and the user identity permission information. The terminal compliance status is obtained by querying from the distributed key-value database, and the user identity permission information is retrieved from the policy knowledge base; After receiving the operation behavior data, the linkage decision engine starts a real-time policy evaluation process. First, the engine sends a query request to the distributed key-value database (such as etcd) based on the terminal device fingerprint hash value of the current session to obtain the latest compliance status snapshot of the terminal. This status is periodically updated by the terminal management and control module (default synchronization every 30 seconds) and includes key metrics such as whether the firewall is enabled, whether the anti-virus software is running, and whether there are unauthorized processes. If any of the metrics deteriorates, it is marked as "non-compliant".

[0046] Simultaneously, the engine retrieves the user's complete identity and permission model from the policy knowledge base, including the minimum permission set corresponding to their role (such as "view customer information only" and "prohibit exporting sensitive documents"), data classification access rules (such as GDPR, trade secret, etc.), and historical behavior baselines. Permission information is organized in a combination of RBAC (role-based access control) and ABAC (attribute-based access control), supporting fine-grained policy matching.

[0047] S1043: If the current compliance status of the terminal is non-compliant, or the operation exceeds the scope of the user's identity and permissions, a data protection policy is triggered. The data protection policy includes blocking the current file export operation, freezing the virtual desktop instance, generating an audit log containing operation behavior data, terminal device fingerprint hash value, user identity token and timestamp, and pushing the audit log to the administrator's backend system.

[0048] After the linkage decision engine completes the dual-dimensional verification, it enters the strategy decision stage. If any of the following conditions are met: (1) the terminal is currently in a "non-compliant" state (such as the antivirus software exiting unexpectedly or the system being rooted); (2) the user's operation exceeds its preset permission range (such as an ordinary employee trying to export financial statements), then the predefined data protection strategy combination will be activated immediately.

[0049] First, the system sends an instruction to the virtual desktop management platform to block ongoing file export operations or disable peripheral redirection functions to prevent data outflow. Second, it issues a "freeze" command to the user's virtual desktop instance, preventing further interaction, but preserving the session context for investigation and evidence collection. Simultaneously, the policy execution point generates a high-priority audit log. The log content strictly follows the "five-tuple" format, including operation details, terminal device fingerprint hash value, user identity token, virtual desktop instance ID, and a timestamp accurate to milliseconds, and is appended with a digital signature to ensure integrity.

[0050] The audit logs are pushed in real time to SIEM (Security Information and Event Management System) and the administrator's operations and maintenance backend via asynchronous message queues, triggering alarm notifications. When necessary, it can also be linked with the SOAR platform to automatically perform subsequent actions such as isolation and account locking. In addition, the system records the entire policy triggering chain, forming a traceable operation trajectory, which meets the requirements of information security compliance and internal audit.

[0051] In summary, this step enables real-time monitoring of user actions and terminal security status, and relies on a linkage decision engine to achieve context-based risk perception and automated response, truly realizing "one-time authentication does not equal permanent trust", effectively improving the dynamism and closed-loop capability of the overall security protection system.

[0052] Please see Figure 2This is a schematic diagram of a dynamic security protection device based on zero trust and virtual desktop provided in an embodiment of this application. Security protection is achieved through a collaborative architecture deployed on user terminals and cloud systems; the dynamic security protection device 700 includes: The proxy data collection module 710 is used to collect and report the hardware and software security compliance data of the terminal through a proxy module deployed on the user terminal. The access request processing module 720 is used to obtain the user's business access request, and when the software and hardware security compliance data determines that the business access request terminal is in a compliant state, it allows the user to be authenticated. The authentication is zero-trust multi-factor authentication. The virtual desktop allocation module 730 is used to allocate a corresponding virtual desktop instance according to the user's identity and permissions after the user's authentication is successful, and to establish and maintain a unique association mapping relationship between the terminal, the user's identity and the virtual desktop instance. The dynamic policy execution module 740 is used to monitor the user's operation behavior and the security status of the terminal in real time during the user's use of the virtual desktop instance, and to execute dynamically triggered security policies based on the operation behavior and / or security status.

[0053] Furthermore, when the proxy data collection module 710 is used to collect and report the hardware and software security compliance data of the terminal through the proxy module deployed on the user terminal, it is specifically used for: When the terminal starts up, a compliance check is automatically performed. The compliance check includes checking whether the operating system patch version has reached a preset version threshold, checking whether the antivirus software virus database update time is within a preset time range, and checking whether an unauthorized external storage device is connected. Generate hardware and software security compliance data for the terminal based on the compliance check results.

[0054] Furthermore, the hardware compliance data includes CPU model, memory capacity, and external device type; the software compliance data includes patch version, antivirus software status, and process list.

[0055] Furthermore, when the access request processing module 720 uses the software and hardware security compliance data to determine that the business access request terminal is in a compliant state and allows user authentication, it specifically performs the following: By capturing access request events sent by the portal system through an event-driven architecture, extracting terminal device identifiers, user identity identifiers, and timestamp metadata from the request headers, and generating standardized authentication context objects; The compliance status query interface is invoked to initiate a real-time query to the data fusion engine. The query uses a bidirectional streaming communication protocol to transmit serialized data. Multi-source data association queries are executed in the data fusion engine, including retrieving terminal compliance assessment results from the distributed cache and using a Bloom filter to verify the mapping relationship between terminal identity and compliance report. A state machine verification model is used for terminal compliance verification. The model calculates a comprehensive compliance score based on a preset set of compliance rules. When the comprehensive compliance score reaches a threshold, a two-factor authentication combination including password and facial recognition is dynamically assembled.

[0056] Furthermore, when the virtual desktop allocation module 730 allocates corresponding virtual desktop instances according to user identity permissions and establishes and maintains a unique association mapping relationship between the terminal, user identity, and the virtual desktop instance, it is specifically used for: After user authentication is successful, the user role attributes are obtained. Based on the user role attributes, the corresponding desktop instance is matched from the policy knowledge base to assign policy templates. The ordinary employee role corresponds to the basic office desktop instance configuration parameters, and the administrator role corresponds to the desktop instance configuration parameters that include the operation and maintenance tool image and privileged instruction set. The matching desktop instance allocation policy template is submitted to the policy description language parser for syntax analysis and semantic verification to generate a structured policy object. The resource scheduling interface of the virtual desktop management platform is called to pass the structured policy object to create a containerized virtual desktop instance with the corresponding permission level. At the same time, the three-element mapping binding process is started, and the terminal device fingerprint hash value, user identity token and the created virtual desktop instance ID are written as association keys to the distributed key-value database, and access control policies are set.

[0057] Furthermore, when the dynamic policy execution module 740 monitors the user's operational behavior and the security status of the terminal in real time, and executes dynamically triggered security policies based on the operational behavior and / or security status, it is specifically used for: When it is detected that a user is performing a data export operation or connecting an external storage device within the virtual desktop, the operation behavior data is collected through the agent module deployed within the virtual desktop and uploaded to the linkage decision engine. The linkage decision engine obtains the current compliance status of the terminal and the user's identity and permission information. The terminal compliance status is obtained by querying the distributed key-value database, and the user's identity and permission information is retrieved from the policy knowledge base. If the terminal's current compliance status is non-compliant, or the operation exceeds the user's identity and permissions, a data protection policy is triggered. The data protection policy includes blocking the current file export operation, freezing the virtual desktop instance, generating an audit log containing operation behavior data, terminal device fingerprint hash value, user identity token and timestamp, and pushing the audit log to the administrator's backend system.

[0058] The dynamic security protection device based on zero trust and virtual desktops provided in this application collects software and hardware compliance data through a terminal-side proxy module. During the access request phase, it determines whether authentication is allowed based on the compliance status, employing a zero-trust multi-factor authentication mechanism to ensure user legitimacy. After successful authentication, it dynamically allocates virtual desktop instances according to user permissions and establishes a unique mapping relationship between the terminal, user identity, and virtual desktop. During the session, it continuously monitors operational behavior and terminal security status, dynamically triggering security response strategies based on risks. This device achieves end-to-end dynamic security control, improving data security and access controllability in enterprise remote office environments.

[0059] This application also provides an electronic device. The electronic device includes a processor, a memory, and a bus.

[0060] The memory stores machine-readable instructions executable by the processor. When the electronic device is running, the processor and the memory communicate via a bus. When the machine-readable instructions are executed by the processor, the steps of the dynamic security protection method based on zero trust and virtual desktop as described in any of the above method embodiments can be executed. For specific implementation methods, please refer to the foregoing method embodiments, which will not be repeated here.

[0061] This application also provides a computer-readable storage medium storing a computer program. When the computer program is run by a processor, it can execute the steps of the dynamic security protection method based on zero trust and virtual desktop as described in any one of claims 1 to 7. For specific implementation methods, please refer to the foregoing method embodiments, which will not be repeated here.

[0062] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0063] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the shown or discussed mutual couplings, direct couplings, or communication connections may be through some communication interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.

[0064] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0065] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0066] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a processor-executable, non-volatile, computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0067] Finally, it should be noted that the above-described embodiments are merely specific implementations of this application, used to illustrate the technical solutions of this application, and not to limit them. The scope of protection of this application is not limited thereto. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments, or make equivalent substitutions for some of the technical features, within the scope of the technology disclosed in this application. Such modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be covered within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A dynamic security protection method based on zero trust and virtual desktops, characterized in that, Includes the following steps: The agent module deployed on the user terminal collects and reports the terminal's hardware and software security compliance data. When a user's business access request is obtained, and the software and hardware security compliance data is used to determine that the terminal requesting the business access request is in a compliant state, the user's identity verification is allowed. The identity verification is zero-trust multi-factor authentication. After user authentication is successful, a corresponding virtual desktop instance is allocated according to the user's identity and permissions, and a unique association mapping relationship is established and maintained among the terminal, user identity and the virtual desktop instance. During the user's use of the virtual desktop instance, the system monitors the user's operation behavior and the security status of the terminal in real time, and executes dynamic security policies based on the operation behavior and / or security status.

2. The dynamic security protection method according to claim 1, characterized in that, The process of collecting and reporting the hardware and software security compliance data of the terminal through the agent module deployed on the user terminal includes: When the terminal starts up, a compliance check is automatically performed. The compliance check includes checking whether the operating system patch version has reached a preset version threshold, checking whether the antivirus software virus database update time is within a preset time range, and checking whether an unauthorized external storage device is connected. Generate hardware and software security compliance data for the terminal based on the compliance check results.

3. The dynamic security protection method according to claim 2, characterized in that, The hardware and software security compliance data includes CPU model, memory capacity, and external device type; the software compliance data includes patch version, antivirus software status, and process list.

4. The dynamic security protection method according to claim 1, characterized in that, When the software and hardware security compliance data is used to determine that the service access request terminal is in a compliant state, allowing user authentication includes: By capturing access request events sent by the portal system through an event-driven architecture, extracting terminal device identifiers, user identity identifiers, and timestamp metadata from the request headers, and generating standardized authentication context objects; The compliance status query interface is invoked to initiate a real-time query to the data fusion engine. The query uses a bidirectional streaming communication protocol to transmit serialized data. Multi-source data association queries are executed in the data fusion engine, including retrieving terminal compliance assessment results from the distributed cache and using a Bloom filter to verify the mapping relationship between terminal identity and compliance report. A state machine verification model is used for terminal compliance verification. The model calculates a comprehensive compliance score based on a preset set of compliance rules. When the comprehensive compliance score reaches a threshold, a two-factor authentication combination including password and facial recognition is dynamically assembled.

5. The dynamic security protection method according to claim 1, characterized in that, The step of allocating corresponding virtual desktop instances based on user identity and permissions, and establishing and maintaining a unique association mapping relationship between the terminal, user identity, and the virtual desktop instance includes: After user authentication is successful, the user role attributes are obtained. Based on the user role attributes, the corresponding desktop instance is matched from the policy knowledge base to assign policy templates. The ordinary employee role corresponds to the basic office desktop instance configuration parameters, and the administrator role corresponds to the desktop instance configuration parameters that include the operation and maintenance tool image and privileged instruction set. The matching desktop instance allocation policy template is submitted to the policy description language parser for syntax analysis and semantic verification to generate a structured policy object. The resource scheduling interface of the virtual desktop management platform is called to pass the structured policy object to create a containerized virtual desktop instance with the corresponding permission level. At the same time, the three-element mapping binding process is started, and the terminal device fingerprint hash value, user identity token and the created virtual desktop instance ID are written as association keys to the distributed key-value database, and access control policies are set.

6. The dynamic security protection method according to claim 1, characterized in that, During the user's use of the virtual desktop instance, the system monitors the user's actions and the security status of the terminal in real time, and executes dynamically triggered security policies based on the actions and / or security status, including: When it is detected that a user is performing a data export operation or connecting an external storage device within the virtual desktop, the operation behavior data is collected through the agent module deployed within the virtual desktop and uploaded to the linkage decision engine. The linkage decision engine obtains the current compliance status of the terminal and the user's identity and permission information. The terminal compliance status is obtained by querying the distributed key-value database, and the user's identity and permission information is retrieved from the policy knowledge base. If the terminal's current compliance status is non-compliant, or the operation exceeds the user's identity and permissions, a data protection policy is triggered. The data protection policy includes blocking the current file export operation, freezing the virtual desktop instance, generating an audit log containing operation behavior data, terminal device fingerprint hash value, user identity token and timestamp, and pushing the audit log to the administrator's backend system.

7. A dynamic security protection device based on zero trust and virtual desktop, characterized in that, include: The proxy data collection module is used to collect and report the hardware and software security compliance data of the user terminal through a proxy module deployed on the user terminal. The access request processing module is used to obtain the user's business access request, and when the software and hardware security compliance data determines that the business access request terminal is in a compliant state, it allows the user to be authenticated. The authentication is zero-trust multi-factor authentication. The virtual desktop allocation module is used to allocate corresponding virtual desktop instances according to user identity and permissions after user authentication is successful, and to establish and maintain a unique association mapping relationship between the terminal, user identity and the virtual desktop instance; The dynamic policy execution module is used to monitor the user's operation behavior and the security status of the terminal in real time during the user's use of the virtual desktop instance, and to execute dynamically triggered security policies based on the operation behavior and / or security status.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, which, when executed by a processor, performs the steps of the dynamic security protection method based on zero trust and virtual desktop as described in any one of claims 1 to 6.

Images